Audit risk assessment: 5% anomaly threshold vs. materiality—expand testing

This guide explains why a 5% anomaly threshold is a screening trigger rather than a conclusion about materiality. It provides rules for investigating cause, account-level exposure, qualitative effects, and related anomalies to determine when testing should expand.

Treat 5% as an alert generator

Treat 5% as a screening threshold, not as a conclusion that an anomaly is immaterial. Apply the screen consistently, but record the exact numerator and denominator used to calculate it. Transaction value, recorded balance, expected value, control deviations, and model residuals each create a different alert population. For example, an unusual journal could be screened against total transaction value, the affected account balance, the recorded amount, or the aggregate value of control deviations. Documentation should state the population boundary, period, selection method, calculation, and any exclusions so another reviewer can reproduce the result.

For every observation that exceeds the screen, trace it before classifying it. Link the anomaly to the affected account and financial-statement assertion, identify the control owner, reconstruct the journal-entry path, and identify the source system and supporting evidence. Then determine whether the deviation reflects an error, unusual but legitimate activity, or a control-design issue. A useful check is whether the transaction passed through every required approval, whether the recorded amount agrees with source documentation, and whether the posting logic matches the approved business purpose. Do not let the percentage alone determine the classification.

If a 5% population-sampling rate was requested, interpret it as the minimum number of items selected for examination under that instruction—not as the percentage below which errors may be ignored. Maintain a listing of selected and unselected items, reconcile the count to the full population, and separately report every sampled item that exceeds the 5% screen. The sampling rate controls the initial sample; it does not resolve an individual anomaly or establish its effect on the financial statements.

After tracing a flagged item, compare its potential misstatement with the engagement’s documented materiality and performance materiality, considering both the account-level amount and its qualitative effects. Also check whether it interacts with related anomalies, reverses in another period, affects the same assertion, or changes a control conclusion. A series of individually modest deviations may be relevant when they share a cause or control weakness. Retain the calculation, evidence, assessment, and disposition for each item. The key rule is simple: 5% tells the team where to look; it does not tell the team whether the matter is immaterial.

Anchor decisions in audit materiality

Anchor materiality decisions in the framework recognized by the Office of the Auditor General and informed by AASB 101, Presentation of Financial Statements. That framework treats materiality as both quantitative and qualitative. Numerical size matters, but it does not operate in isolation: an item may be material because it involves fraud, potential legal consequences, a covenant breach, management bias, or another circumstance that could change users’ understanding of the entity.

For each anomaly, document the appropriate comparison basis before judging its significance. The benchmark may be profit before tax, revenue, total assets, or account-specific performance materiality, depending on the engagement and the nature of the account. Do not apply a universal percentage regardless of context. A check is to ask whether the chosen benchmark reflects the financial statement as a whole or the particular account being tested, and whether the denominator remains sensible after considering unusually large transactions, seasonal activity, or changes in the account’s operating scale.

Perform the comparison consistently, but record the underlying amount, benchmark, and rationale. Then consider whether the anomaly affects the financial statements through recognition, measurement, presentation, classification, or disclosure. An amount below the relevant numerical threshold should not be closed automatically. The investigation should establish the cause, identify the affected assertions, and estimate the potential effect on the reporting period and any related disclosures.

Qualitative significance can override a modest arithmetic amount. Treat an item as qualitatively material when it suggests management override, a possible fraud, a legal or regulatory consequence, a covenant breach, management bias, or an error that may recur. The assessment should also consider whether the item affects a sensitive transaction, masks a change in earnings or liquidity, changes the apparent trend of a key measure, or could influence decisions by investors, lenders, or other financial-statement users.

Finally, test whether multiple individually modest anomalies point to a larger problem in the same account, transaction stream, or control. Their combined effect may be more consequential than any one amount, and repeated prior-year errors may indicate a control weakness, estimation problem, management bias, or complex accounting area. The governing rule is to connect the numerical comparison with the nature, cause, and financial-statement consequences of the item. A documented conclusion should identify which benchmark was used, which qualitative factors were considered, what was investigated, and why the resulting effect does or does not require additional audit work.

Choose the testing response

Begin with the anomaly’s characteristics rather than its screening status. If the item is isolated, its cause is fully explained, the accounting treatment is correct, and the resulting financial-statement effect is clearly immaterial, document the evidence and conclusion, retain the monitoring result, and do not expand substantive testing. The file record should identify the transactions or control observations reviewed, the explanation obtained, the accounting entry or disclosure assessed, and the basis for concluding that the anomaly is immaterial. A recurring issue should not be treated as isolated merely because the same explanation has been used in prior periods.

Expand testing when any uncertainty remains. A useful rule is to require a documented answer to three questions: What caused the anomaly? Could it affect another account, period, entry, estimate, or control? Could the actual or potential error, including the effect of related anomalies, exceed the engagement’s documented materiality threshold? If the cause is uncertain, the account has a susceptibility to error, or the effect approaches materiality, expand horizontally across related accounts and periods, trace selected entries to supporting evidence, and increase control samples in the affected process. The comparison should use the anomaly’s account-level amount and potential effect, not only the transaction that generated the screen.

Use a different response when the anomaly indicates override, fraud, or deliberate manipulation. Expand vertically through the entity’s control structure, including journals, estimates, management adjustments, confirmations, and other sensitive transactions, and assess whether the conduct affects revenue recognition, estimates, or disclosures. The required test is whether the same control failure or management override could conceal additional misstatements. Preserve the initial evidence, document who approved the expansion, and update the audit documentation as the investigation changes the assessed risk or the reported financial-statement effect.

This cause-sensitive, risk-based expansion is superior to both automatic closure after the screen and indiscriminate testing of the full population. It gives the auditor a practical decision rule: close the matter only when its cause, effect, and scope are sufficiently resolved; otherwise, expand in the direction suggested by the risk and reassess the evidence obtained. This approach allocates substantive testing to matters that could change the audit response while avoiding unnecessary work where the investigation is complete and the potential effect remains clearly immaterial.

Budget by response tier

Tier 2—targeted testing is appropriate when the cause of the anomaly or its financial-statement effect remains uncertain. The budget should cover a related-period comparison, a review of nearby journal entries, an account reconciliation, and a walkthrough of relevant controls. The auditor should first identify the population from which the item was selected, then test items sharing its characteristics rather than testing randomly without a defined objective. A useful planning check is whether the selected procedures address each unresolved possibility: recurrence, incorrect estimation, unauthorized activity, or control misoperation.

Tier 3—expanded testing is appropriate when evidence indicates a possible pervasive failure. Scope should be derived from the size and composition of the affected population, the reliability and completeness of available data, the extent to which controls can be relied upon, and the possibility that similar errors recur. Expand testing when the account-level amount, qualitative effects, or interaction with related anomalies could exceed the engagement’s documented materiality. The auditor should also compare the tested error results with the expected control risk and reconsider whether performance materiality needs revision.

Planning should translate each tier into a controlled estimate of audit hours. For each anomaly, record the number of items expected, source-system and data-extraction time, evidence-reconciliation time, review and documentation time, supervisor review, and any expected rework. These variables allow the engagement team to compare the cost of targeted work with the cost of broader testing before fieldwork begins. The estimate should be updated when new evidence changes the response tier; carrying a Tier 1 estimate after discovering a control failure would understate the work required.

At least monthly, the engagement team should compare actual hours and results with the budget by tier. If a Tier 2 item begins to resemble a pervasive issue, move it promptly to Tier 3 rather than completing the original narrow scope. Conversely, retain a lower-cost response only when the additional evidence resolves the uncertainty and the workpaper documents that basis. This creates a repeatable mechanism for allocating audit effort according to risk, evidence, and the complexity of the affected population.

Separate evidence from inference

An anomaly score identifies statistical unusualness, but it does not establish misstatement, fraud, or the affected assertion. It is evidence for further inquiry, not a substitute for an audit conclusion. Before relying on the score, document the population included, the scoring method, the relevant period, and the exact transaction value, recorded balance, or control deviation used as the numerator and denominator. Then compare the flagged item with comparable history and with the source data supporting its classification. This procedure separates observable evidence from assumptions about cause, effect, and risk.

A high score can arise from legitimate business activity rather than error. Test for seasonal patterns, one-time contracts, reclassification between accounts, rounding, missing master data, and changes in the anomaly model’s training distribution. For each explanation, retain corroborating evidence, such as approved contracts, supporting invoices, account mappings, entry history, and management explanations. Do not accept an explanation merely because it is plausible: confirm that the evidence explains the complete recorded amount and the specific pattern that triggered the alert. If the data used by the model changed, compare the current result with the same calculation performed on a consistent historical population.

A low score is not a clean bill of health. An ordinary-looking journal can still be fictitious, circular, posted outside expected business hours, or deliberately structured to remain just below a detection boundary. Accordingly, review the journal’s existence, business purpose, approver, posting pattern, counterparty, and accounting treatment. Where the score reflects only statistical distance, ask whether the journal has characteristics the model was not designed to detect. Corroborate the entry to external evidence and investigate repeated or interconnected activity even when no single item produces a conspicuous score.

Model reliability also needs a documented foundation. Record model precision, the false-positive rate achieved on known legitimate exceptions, population completeness, and data lineage from source systems to the monitoring output. Confirm that records were not omitted, duplicated, transformed, or mapped to outdated reference data, and that the validation population includes the kinds of transactions and control events encountered in the current period. Without those records, the score cannot support a decision about whether an item is erroneous. Use it to direct inquiry, preserve contradictory evidence, and require the underlying facts—not the model’s confidence label—to determine the testing response.

Calculate the escalation decision

Start with the calculation rather than the label. Expected monthly revenue of $20 million multiplied by 5% produces a $100,000 screening threshold. A $600,000 journal represents 3% of expected monthly revenue, not more than 5%, because $600,000 ÷ $20,000,000 = 0.03. If monitoring nevertheless flags the item under the stated 5% rule, the documentation should be corrected or the rule should identify another relevant denominator. Until that is resolved, do not use the flag as evidence that the anomaly is immaterial.

Suppose the $600,000 posting is escalated for investigation. It equals the $600,000 performance materiality assigned to revenue, and it equals 60% of the $1 million overall financial-statement materiality benchmark. Neither comparison is a safe basis for closure. The posting’s account-level amount requires investigation of its cause and financial-statement effect, and the evaluation should also consider whether the revenue misstatement changes the direction or size of reported results.

Separate the posting into identifiable components before deciding how far to test. If $250,000 relates to a duplicate invoice, examine the underlying invoice, purchase record, receipt evidence, payment status, and subsequent correction. That $250,000 is 25% of overall materiality and 41.67% of revenue performance materiality. The remaining $350,000 is 35% of overall materiality and 58.33% of revenue performance materiality. Neither component may be dismissed merely because the full journal is below overall materiality.

Use a documented decision check: investigate the cause and financial-statement effect of every screened item; expand testing when the account-level amount reaches performance materiality, could combine with related anomalies to approach or exceed overall materiality, or presents significant qualitative effects. In this example, the full $600,000 posting reaches performance materiality, while the duplicate-invoice component of $250,000 warrants targeted expansion because its cause may recur across invoices. Record the population searched, the additional procedures performed, the errors found, and the aggregation of related anomalies.

Apply five escalation rules

Rule 1: Investigate immediately when the anomaly exceeds 5%. Recalculate the ratio using the documented numerator, denominator, and population. Confirm that the denominator is appropriate for the item being tested, such as the relevant transaction, account balance, or control population. Once the ratio exceeds 5%, investigate the cause and its possible financial-statement effect promptly. Record the explanation, evidence obtained, affected accounts, and proposed response. The percentage is an escalation trigger; it is neither evidence that the anomaly is immaterial nor proof of a material misstatement.

Rule 2: Expand testing when the potential error equals or exceeds performance materiality. Compare the best available estimate of the error with the engagement’s documented performance materiality, not merely with the 5% screening ratio. If the estimated error reaches that benchmark, expand testing across the relevant account, period, and control. The purpose is to determine whether the misstatement is bounded, remains below the threshold, or requires further resolution. Continue the expansion until the amount is adequately bounded or the identified risk is resolved.

Rule 3: Aggregate alerts that are linked by a common source. Do not assess two or more alerts separately when they share an account, preparer, process, or control. Combine their estimated effects, adjusting for overlap so that the same transaction is not counted twice. Then ask whether the combined amount meets an escalation threshold and whether the pattern indicates systematic bias, recurring control weakness, estimation error, or management manipulation. A cluster of individually modest alerts can require broader testing when their effects accumulate or reveal a common cause.

Rule 4: Expand for qualitative effects even when the amount is small. Investigate whether an alert affects fraud, legal or regulatory obligations, covenant compliance, management compensation, public reporting, or a sensitive transaction. Consider whether it changes the presentation or could influence users’ decisions even after considering its numerical size. Document the rationale for expansion, the evidence reviewed, and the testing performed. A quantitatively limited anomaly should not be closed solely because its percentage is below 5%.

Rule 5: Resolve or document the scope decision. For every alert, retain the final assessment: the anomaly’s cause, estimated effect, related alerts considered, qualitative implications, testing performed, and conclusion. These five conditions convert anomaly alerts into audit scope decisions while preserving a clear distinction between initial screening, investigation, and the decision to expand testing.

What to do next

Frequently Asked Questions

Does an anomaly below 5% automatically count as immaterial?

No, 5% is a screening trigger rather than proof of immateriality, and qualitative factors may make an otherwise small anomaly significant.

What should be investigated for every anomaly above 5%?

Investigate the cause and financial-statement effect of every anomaly above 5% of the relevant transaction, account balance, or control population.

When should testing be expanded based on an anomaly's amount?

Expand testing when an anomaly's account-level amount could exceed documented materiality.

What should an auditor document when applying the 5% screen?

Record the exact numerator and denominator used to calculate the 5% screening threshold.

How should related anomalies be evaluated?

Review related anomalies for recurrence and cumulative effect, including whether similar errors could indicate recurring control weaknesses, estimation problems, management bias, or complex accounting areas.

What should be considered if similar errors could recur?

Consider expanding testing as appropriate if similar errors could recur and indicate recurring control weaknesses, estimation problems, management bias, or complex accounting areas.

Quick answers

Also worth reading: Why risk assessment is the most critical step in a successful financial audit: Why risk assessment is the · Audit anomaly scores explained: 5% flagged means expand testing: Audit anomaly scores explained: 5% · How to tailor risk assessment for complex financial audits: How to tailor risk assessment